(1) - the source IP won't be in the IP header, but is usually added to the HTTP headers so endpoint and TLAs will see who is connecting.

(2) - have to concur, though sadly, you will obviously be exposed (and identifiable) to institutional meddlers with no warning.